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REMARKS 

Claims 1, 16-18, 23 and 25 have been cancelled; claims 2, 8, 9, 19, 20-22, 24 and 26-28 
have been amended; claims 2-15, 19-22, 24 and 26-28 remain pending in the application. 

Claims 1,18, 20-23 and 26-28 are rejected under 35 U.S.C. 102(b) as being anticipated 
by the XACCT Usage Overview of 1 997. In response, claims 1,18 and 23 have been cancelled, 
claim 9 has been amended to depend from claim 2, claims 20-22 have been amended to depend 
from claim 19, and claims 26-28 have been amended to depend from claim 24. Claims 2, 19 and 
24 have been re-written in independent form. 

Claims 2-17, 19, 24-25 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
the XACCT Usage Overview as applied to claim 1 , in view of the "ICMP Protocol Overview", 
and further in view of U.S. Patent No. 6, 243,667, to Kerr et al. ("Kerr"). Claims 16-17 and 25 
have been cancelled. This rejection as applied to amended (now independent) claims 2, 19 and 
24, as well as dependent claims3-15, 20-22 and 26-28, is respectfully traversed. 

Claim 2 is directed to a method of analyzing a flow for an accounting application. 
The method of claim 2 includes capturing an IP packet from a network segment and determining 
if the IP packet includes a message of a first protocol type for providing error reporting. The 
message has an IP packet that triggered an error event embedded within, and the embedded IP 
packet is of a second protocol type and has a flow associated with it. The method further 
includes correlating the flow associated with the embedded IP packet to a stored parent flow of a 
given state, thereby associating the error event with the given state of the stored parent flow, and 
using the results to provide well-informed accounting information related to the flow to the 
accounting application. 

The XACCT Usage Overview does not teach or suggest any elements of the claimed flow 
analysis method as set forth in claim 2. Rather, the XACCT Usage Overview describes a 
system that collects accounting information from different sources and uses that information to 
produce accounting records. No where in the XACCT Usage Overview is it suggested that the 
system performs any kind of flow analysis on captured packets, let alone the type of analysis that 
is set forth in claim 2, that is, an analysis that associates, for a given flow, an error event with 
stored state information so that well-informed accounting information related to the flow may be 
provided to an accounting application. 
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Nor does Kerr teach or suggest the method of claim 2. In particular, Kerr fails to teach or 
suggest determining if an IP packet includes a message of a protocol type for providing error 
reporting, correlating a flow associated with an IP packet embedded in the error reporting 
message to a stored parent flow so that an error event triggered by the embedded IP packet is 
associated with the state of the stored parent flow, and using the results to provide well-informed 
accounting information related to the flow to an accounting application, as set forth in claim 2. 
Kerr describes building a message flow cache that stores information about message flows and 
using that information to process packets associated with each message flow. A packet's flow is 
determined by examining the packet's header information, including source and destination 
address, along with protocol type. The information relates to the proper treatment of packets in a 
message flow, e.g., treatment with regard to switching, access control and encryption (Col. 4, 
lines 20-34). Kerr also describes entering into a flow's cache entry for each packet some type of 
accounting information, such as timestamps, a cumulative count of number of packets and 
cumulative count of number of bytes for the flow (Col. 5, lines 10-15; Col. 6, lines 56-64). 
Information stored in a flow entry can be used to generate historical information, which can be 
recorded in a flow table and subsequently reported to an external device (Col. 7, lines 56-67; 
Col. 8, lines 1-50). 

Thus, Kerr teaches associating a packet with stored flow information based on the 
packet's header information (including protocol type), using some flow information to determine 
how to route the packet and updating other flow information, e.g., accounting information, for 
reporting purposes. The routing device in Kerr does not, however, examine a packet's pay load if 
the protocol type indicates an error message, and correlate the flow of the embedded packet (that 
is, the error message payload) with a stored parent flow to associate an error event triggered by 
the embedded packet with state information of the stored parent flow. In other words, Ken- 
performs a flow correlation for a packet, but not a packet embedded within that packet. For a 
packet having a protocol type corresponding to an error reporting protocol, such as ICMP 
(described in the cited ICMP Protocol Overview, and discussed on pages 54-55 of Applicant's 
specification), for example, Kerr does not suggest any analysis of the embedded packet 
information, more particularly, correlating its flow to a stored parent flow to associate an error 
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event with stored state information, and using the results to provide well-informed accounting 
information to an accounting application. 

Thus, none of the cited art, either alone or in combination, teaches or suggests the method 
of claim 2. At most, the combined teachings of XACCT Usage Overview, the ICMP Protocol 
Overview and Kerr would yield no more than a mechanism by which a flow of a packet of a 
particular protocol type (e.g., ICMP) would be matched to a cache entry of flow information, 
including accounting information, which is updated and perhaps provided for use in generating 
accounting records. Consequently, method claim 2 is patentably distinct over the cited art and 
therefore allowable. 

Corresponding computer program claim 1 9 and system claim 24 are similar in scope to 
method claim 2 and are therefore allowable for the same reasons. 

Dependent claims 3-15, 20-22 and 26-28 are allowable for at least the same reasons as 
the independent claim from which they each depend, either directly or indirectly. 

Attached is a marked-up version of the changes being made by the current amendment. 

Applicant asks that all pending claims be allowed. Enclosed is a Petition for Extension of 
Time and a check in the amount of the required fee. Please apply any other charges or credits to 
Deposit Account No. 06-1050. 

Respectfully submitted, 



Date: O^f 

/ Cathy 1/ Peterson 

Reg. No. 41,249 

Fish & Richardson P.C. 

225 Franklin Street 

Boston, Massachusetts 021 10-2804 

Telephone: (617)542-5070 

Facsimile: (617)542-8906 
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Version with markings to show changes made 



In the claims: 

Claim 1, 16-18, 23 and 25 have been cancelled. 

Claims 2, 8, 9, 19-22, 24 and 26-28 have been amended as follows: 

2. (Once Amended) [The method of claim 1, wherein mapping comprises:] A method of 
analyzing a flow for an accounting application, comprising: 
capturing an IP packet from a network segment; 

determining if the captured IP packet includes a message of [the] a first protocol type for 
providing error reporting, the message having an IP packet that triggered an error event 
embedded within, the embedded IP packet being of [the] a second protocol type and having a 
flow associated therewith; [and] 

correlating the flow associated with the embedded IP packet to a stored parent flow of a 
given state, thereby associating the error event with the given state of the stored parent flo w; and 

using the results of the correlating to provide well-informed accounting information 
related to the flow to the accounting application . 

8. (Once Amended) The method of claim [1] 6, wherein [mapping] using [further] 
comprises: 

reporting a transaction stop indication in response to the change of the given flow state to 
the rejected state. 

9. (Once Amended) The method of claim 2, wherein [mapping] correlating further 
comprises: 

processing the captured IP packet. 
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19. (Once Amended) [The computer program product of claim 1 8, wherein the instructions to 
cause a computer to map protocol information further comprise instructions to cause a computer 
to] A computer program product residing on a computer-readable medium for analyzing a flow 
for an accounting application, comprising instructions to cause a computer to : 

capture an IP packet from a network segment; 

determine if the captured IP packet includes a message of [the] a first protocol type for 
providing error reporting, the message having an embedded IP packet that triggered an error 
event, the embedded IP packet being of [the] a second protocol type and having a flow 
associated therewith; [and] 

correlate the flow associated with the embedded IP packet to a stored parent flow of a 
given state to associate the error event with the given state of the stored parent flo w; and 

use results of the correlating to provide well-informed accounting information related to 
the flow to the accounting application . 

20. (Once Amended) The computer program product of claim [1 8] 19, wherein the first 
protocol is the Internet Control Message Protocol. 

2 1 . (Once Amended) The computer program product of claim [18] j_9, wherein the second 
protocol type is the Transmission Control Protocol. 

22. (Once Amended) The computer program product of claim [1 8] J_9, wherein the first 
protocol type is the Internet Control Message Protocol and the second protocol type is the 
Transmission Control Protocol. 



Applicant : William Carter C 1 Bui lard 
Serial No. : 09/276,277 
Filed : March 25, 1999 
Page : 9 

24. (Once Amended) [The system of claim 23 wherein the instructions to cause a computer to 
map protocol information further comprise instructions to cause a computer to] A system for 
flow of network packet data, comprising : 
a processor; 

a memory storing a computer program product residing on a computer-readable medium 
for analyzing a flow for an accounting application, comprising instructions to cause a 
computer to: 

capture an IP packet from a network segment; 

determine if the captured IP packet includes a message of the first protocol type for 
providing error reporting, the message having an embedded IP packet that triggered an error 
event, the embedded IP packet being of the second protocol type and having a flow associated 
therewith; 

correlate the flow associated with the embedded IP packet to a stored parent flow of a 
given state to associate the error event with the given state of the stored parent flow; and 

use the results of the correlating to provide well-informed accounting information related 
to the flow to the accounting application . 

26. (Once Amended) The system of claim [23] 24 wherein the first protocol is the Internet 
Control Message Protocol. 

27. (Once Amended) The system of claim [23] 24 wherein the second protocol type is the 
Transmission Control Protocol. 

28. (Once Amended) The system of claim [23] 24 wherein the first protocol type is the 
Internet Control Message Protocol and the second protocol type is the Transmission Control 
Protocol. 
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